Globus Endpoint Administration Rachana Ananthakrishnan - [email protected] Greg Nawrocki - [email protected] Johns Hopkins University April 11, 2019
Rachana Ananthakrishnan- [email protected] [email protected] Greg Nawrocki [email protected] Johns Hopkins University April 11, 2019. The DTN and Globus Connect
Jun 01, 2020
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Globus Endpoint Administration
Rachana Ananthakrishnan - [email protected]
Greg Nawrocki - [email protected]
Johns Hopkins UniversityApril 11, 2019
The DTN and Globus Connect Server
Current - Full feature set: GCS 4.xFuture – Some features currently available: GCS 5.x
Globus Connect Server
5
• Makes your storage accessible via Globus
• Multi-user server, installed and managed by sysadmin
docs.globus.org/globus-connect-server-installation-guide/
Local system users
Local Storage System(HPC cluster, NAS, …)
Globus Connect Server
MyProxy
CA
GridFTP
Server
OAuth
Server
DTN
• Default access for all local accounts
• Native packaging Linux: DEB, RPM
Globus Connect Server
6
Local system users
Local Storage System(HPC cluster, NAS, …)
Globus Connect Server
MyProxy
CA
GridFTP
Server
OAuth
Server
DTN
Non-POSIX Connectors
POSIX-compliant Connector
server
Creating a Globus endpoint on your server
• In this example, Server = Amazon EC2 instance
• Installation and configuration of Globus Connect Server requires a Globus ID
• Go to globusid.org
• Click “create a Globus ID”– Optional: associate it with your Globus account
7
What we are going to do:
Install Globus Connect Server• Access server as user “campusadmin”
• Update repo
• Install package
• Setup Globus Connect Server
Server
(AWS EC2)
ssh
ec2-22-23-24-25
Log into Globus
Transfer a file
1
2
3 Access the newly created endpoint (as user ‘researcher’)
48
Access your server
• Get the IP address for your EC2 server (bit.ly/ec2ip)
• Log in as user ‘campusadmin’ssh campusadmin@<EC2_instance_IP_address>
• Please sudo su before continuing– User ‘campusadmin’ has passwordless sudo privileges
9
Install Globus Connect Server
$ sudo su$ curl –LOs http://downloads.globus.org/toolkit/globus-connect-server/globus-connect-server-repo_latest_all.deb$ dpkg –i globus-connect-server-repo_latest_all.deb$ apt-get update$ apt-get -y install globus-connect-server$ globus-connect-server-setup
You have a working Globus endpoint!
Use your Globus ID username and
password when prompted
Access the Globus endpoint
• Go to Manage Data à Transfer Files
• Access the endpoint you just created– Search for your EC2 host name in the Endpoint field
– Log in as “researcher”; you will see the user’s home directory
• Transfer files to/from a test endpoint (e.g. ESnet read-only) and your EC2 endpoint
11
Globus accounts and endpoint access
• Globus account: Primary identity (+ Linked Identities)
• Endpoint initially accessible by creator
• Endpoint not visible?– Primary identity is your institutional ID?
– Link your Globus ID!
Configuring Globus Connect Server
13
Endpoint configuration
• Globus service “Manage Endpoints” page
• DTN (Globus Connect Server) config/etc/globus-connect-server.conf
– Standard .ini format: [Section] Option = Value– To enable changes you must run:
globus-connect-server-setup
– “Rinse and repeat”
14
Common configuration options
• Manage Endpoints page– Display Name– Visibility– Encryption
• DTN configuration file– RestrictPaths– IdentityMethod (CILogon, Oauth)– Sharing– SharingRestrictPaths
Exercise: Make your endpoint visible
• Edit endpoint attributes– Change the name to something useful, e.g. <your_name> EC2
Endpoint
– For the “Visible To” attribute select “Public - Visible to all users”
• Find your neighbor’s endpoint– Thanks to our superb security …you can access it too J
16
Path Restriction
• Default configuration:– All paths allowed, access control handled by the OS
• Use RestrictPaths to customize– Specifies a comma separated list of full paths that clients may access
– Each path may be prefixed by R (read) and/or W (write), or N (none) to explicitly
deny access to a path
– '~’ for authenticated user’s home directory, and * may be used for simple
wildcard matching.
• e.g. Full access to home directory, read access to /data:– RestrictPaths = RW~,R/data
• e.g. Full access to home directory, deny hidden files:– RestrictPaths = RW~,N~/.*
17
Exercise: Restrict access
• Set RestrictPaths=RW~,N~/archive
• Run globus-connect-server-setup
• Access your endpoint as ‘researcher’
• What’s changed?
18
• In config file, set Sharing=True
• Run globus-connect-server-setup
• Use the web app to flag as managed endpoint
* Note: Creation of shared endpoints requires a
Globus subscription for the managed endpoint
Enabling sharing on an endpoint
19
Limit sharing to specific accounts
• SharingUsersAllow =
• SharingGroupsAllow =
• SharingUsersDeny =
• SharingGroupsDeny =
20
Sharing Path Restriction
• Restrict paths where users can create shared endpoints
• Use SharingRestrictPaths to customize– Same syntax as RestrictPaths
• e.g. Full access to home directory, deny hidden files:– SharingRestrictPaths = RW~,N~/.*
• e.g. Full access to public folder under home directory:– SharingRestrictPaths = RW~/public
• e.g. Full access to /proj, read access to /scratch:– SharingRestrictPaths = RW/proj,R/scratch
21
Accessing Endpoints
22
Ports needed for Globus
• Inbound: 2811 (control channel)
• Inbound: 7512 (MyProxy), 443 (OAuth)
• Inbound: 50000-51000 (data channel)
• If restricting outbound connections, allow connections on:– 80, 2223 (used during install/config)
– 50000-51000 (GridFTP data channel)
23
Network Paths - Illustrative
24
Source
security
filters
Destination
security
filters
Destination Science DMZ
Source Science DMZ
SourceBorder Router
Destination Border Router
Source Router Destination RouterUser
Organization
DATA
CONTROL
Physical Control Path
Logical Control Path
Physical Data Path
Logical Data Path
* Ports 443,
2811, 7512
* Ports 50000-
51000
Data Transfer Node (DTN)
Data Transfer Node (DTN)
* Please see TCP ports reference: https://docs.globus.org/resource-provider-guide/#open-tcp-ports_section
End
poin
t act
ivat
ion
usin
g M
yPro
xy Default
configuration
(avoid if at all possible)
End
poin
t act
ivat
ion
usin
g M
yPro
xy O
Aut
h
Best practice
configuration
Single Sign-On with InCommon/CILogon
• Your Shibboleth server must release R&S attributes to CILogon: <RandS>1</RandS>
• Local account must match institutional ID (InCommon ID)– Test by creating a local user with same name
• In /etc/globus-connect-server.conf set:
AuthorizationMethod = CILogon
CILogonIdentityProvider = <institution_listed_in_CILogon_IdP_list>
https://cilogon.org/include/idplist.xml27
Managed endpoints and subscriptions
29
Subscription configuration
• Subscription manager– Create/upgrade managed endpoints
– Requires Globus ID linked to Globus account
• Management console permissions– Independent of subscription manager
– Map managed endpoint to Globus ID
• Globus Plus group– Subscription Manager is admin
– Can grant admin rights to other members
30
Creating managed endpoints
• Required for sharing, management console, reporting, …
• Convert existing endpoint to managed via CLI (or web):
globus endpoint update --managed <endpt_uuid>
• Must be run by subscription manager
• Important: Re-run endpoint update after deleting/re-creating endpoint
31
Monitoring and managing Globus endpoint activity
32
Management console
• Monitor all transfers
• Pause/resume specific transfers
• Add pause conditions with various options
• Resume specific tasks overriding pause conditions
• Cancel tasks
• View sharing ACLs
33
Endpoint Roles
• Administrator: define endpoint and roles
• Access Manager: manage permissions
• Activity Manager: perform control tasks
• Activity Monitor: view activity
34
Demonstration:
Management consoleEndpoint Roles
Usage Reporting
35
…on performance
36
Balance: performance - reliability
• Network use parameters: concurrency, parallelism• Maximum, Preferred values for each• Transfer considers source and destination endpoint settings
min(max(preferred src, preferred dest),max src,max dest
)• Service limits, e.g. concurrent requests
37
Illustrative performance
Disk-to-Disk Throughput: ESnet Testing
0 1,000 2,000 3,000 4,000 5,000 6,000 7,000 8,000 9,000
scp
scp (w/HPN)
sftp
GridFTP(1 stream)
GridFTP(4 streams)
Disk-to-Disk Throughput (Mbps)
39Source: ESnet (2016)
• Berkeley, CA to Argonne, IL
(RTT: 53 ms, Capacity: 10Gbps)
• scp is 24x slower than GridFTP on
this path
• >1 Gbps (125 MB/s) disk-to-disk
requires RAID array
Deployment Scenarios
40
Best-practice deployment
41
10GE
10GE
10GE
10GE
10G
Border Router
WAN
Science DMZSwitch/Router
Enterprise Border Router/Firewall
Site / CampusLAN
High performanceData Transfer Node
with high-speed storage
Per-service security policy control points
Clean, High-bandwidth
WAN path
Site / Campus access to Science
DMZ resources
perfSONAR
perfSONAR
perfSONAR
Details at: fasterdata.es.net
Non-POSIX DSI- Google Drive
- Amazon S3 (native)
- Spectra BlackPearl
- Ceph S3 RadosGW
- HPSS
Non-POSIX DSI- Google Drive
- Amazon S3 (native)
- Spectra BlackPearl
- Ceph S3 RadosGW
- HPSS
The Data Transfer Node
42
Data
Storage
Interface
(DSI) for
POSIX-
compliant
filesystems
AWSEBS
Volume
AWS S3 Bucket
Data Storage Interface
(DSI) for
POSIX-compliant
filesystems
On-premises Data Transfer Node (DTN)
Cloud-hosted DTN
On prem and cloud
based endpoint
hosting
ext* XFSZFS
~/~/scratch
Common endpoint configuration
Data Transfer Node
POSIX
Connector
ext* XFSZFS
GPFSLustre
~/projects
Common endpoint configuration
Data Transfer Node
POSIX
Connector
~/~/scratch
ext* XFSZFS
GPFSLustre
~/projects
Multi-endpoint configuration
Data Transfer Node
POSIX
Connector
Western
Digital
ActiveScale
Connector
~/archive
~/~/scratch
~/vault
ext* XFSZFS
GPFSLustre
~/projects
Multi-endpoint configuration
46
Data Transfer Node
POSIX
Connector
Western
Digital
ActiveScale
Connector
~/archive
AmazonS3
Bucket
Amazon S3
Connector
~/~/scratch
ActiveScale
• Turnkey on-premise object storage
• Globus connector using S3 API
• Low TCO: Manufactures own drives
• Erasure coding
• Auto data integrity checks with self-healing
• Cloud-based systems management tools
• Data Forever: automatic migration to new tech
48
Tape
docs.globus.org/premium-storage-connectors/wd-activescale/
Network paths
• Separate control and data interfaces
• "DataInterface =" option in globus-connect-server-conf
• Common scenario: route data flows over Science DMZ link
49
Dual-homed DTN – high speed data path
Data Transfer
Node
GridFTP
Server
Science DMZ
Control Channel
Data Transfer
Node
GridFTP
Server
Data Channel
if0
if1
Control Channel
Dual-homed DTN – high speed data path
Data Transfer
Node
GridFTP
Server
Science DMZ
Control Channel
Data Transfer
Node
GridFTP
Server
Data Channel
if0
if1
LAN/ Intranet
path
Control Channel
Firewall
if0
if1
Other Deployment Options
52
Encryption
• Requiring encryption on an endpoint– User cannot override
– Useful for “sensitive” data
• Globus uses OpenSSL cipher stack as currently configured on your DTN
• FIPS 140-2 compliance: ensure use of FIPS capableOpenSSL libraries on DTN
www.openssl.org/docs/fips/UserGuide-2.0.pdf
53
Distributing Globus Connect Server components
• Globus Connect Server components– globus-connect-server-io, -id, -web
• Default: -io, –id and –web on single server• Common options
– Multiple –io servers for load balancing, failover, and
performance
– No -id server, e.g. third-party IdP
– -id on separate server, e.g. non-DTN nodes
– -web on either –id server or separate server for OAuth interface
54
ext* XFSZFS
Distributing Globus Connect Server components
Data Transfer
Node
OAuth
Server
GridFTP
Server
MyProxy
CA
Science DMZ(ACL limited)
Port 2811
accepts inbound
connections
from Globus
Firewall
Setting up multiple –io servers
• Guidelines– Use the same .conf file on all servers
– First install on the server running the –id component, then all others
1. Install Globus Connect Server on all servers
2. Edit .conf file on one of the servers and set [MyProxy] Server to the hostname of the server you want the –id component installed on
3. Copy Globus Connect Server configuration file to all servers
4. Run globus-connect-server-setup on the server running the –id component
5. Run globus-connect-server-setup on all other servers
• Repeat steps 2-5 as necessary to update configurations
56
Example: Two-node DTN
57
-id
-io
-io
On other DTN nodes:/etc/globus-connect-server.conf
[Endpoint] Name = globus_dtn[MyProxy] Server = 34.20.29.57
On “primary” DTN node (34.20.29.57):/etc/globus-connect-server.conf
[Endpoint] Name = globus_dtn[MyProxy] Server = 34.20.29.57
Join the Globus community
• Access the service: globus.org/login
• Create a personal endpoint: globus.org/app/endpoints/create-gcp
• Documentation: docs.globus.org
• Engage: globus.org/mailing-lists
• Subscribe: globus.org/subscriptions
• Need help? [email protected]
• Follow us: @globusonline
Related Documents
